Privacy Policy

Who this is

PDF Toolkit is a small, one-person product. For UK GDPR purposes, the data controller is the operator of PDF Toolkit, reachable at pdftoolkit@icloud.com for anything on this page.

Your files and data

Fourteen of PDF Toolkit's fifteen tools (Merge, Compress, Resize, Rotate, Split, Protect, Redact, Fill & Sign, Images→PDF, PDF→Images, Compare, Form Builder, Bates Numbering, and Smart Redaction) run entirely inside your browser tab, using JavaScript libraries (pdf-lib and pdf.js) loaded once from a CDN — Make Searchable is the fifteenth, and the one genuine exception, covered in the next paragraph. Fill & Sign's typed-signature fonts (a few extra Google Fonts handwriting styles) load the same way as the site's main font — see the Google row below — not as a separate exception. The PDFs and images you drop in are never uploaded anywhere — there's no server for them to go to. The Invoice Generator (invoices, quotes, and expense reports), the Expense Log & Tax Pot Estimator, and the Dividend Tax & Take-Home Pay Calculator work the same way: the client details, line items, expense rows, mileage, and company/salary/dividend figures you type in are used only to render a live preview and build a PDF/CSV in your own browser (via jsPDF), never sent anywhere. Image Toolkit's Compress & Convert tool is the same story with a different library: it decodes, resizes, and re-encodes every image using the browser's own built-in Canvas API — no external image-processing library or server involved at all. You can check any of this yourself: open your browser's Network tab while you use a tool and you'll see nothing sent while a file or a tax calculation is processed. This is the one part of this policy that isn't a promise about how we handle your data — it's a statement about what the code physically does.

Three genuine exceptions, all the same shape — a one-time model download, never your actual file: the Expense Log & Tax Pot Estimator's "Scan a receipt" feature and PDF Toolkit's "Make Searchable" tool both read your photo/PDF using Tesseract.js, an OCR library that runs in your browser (a Web Worker + WebAssembly, not a server) — but on first use each downloads its worker/engine code and an English-language text-recognition model (around 15MB) from public CDNs (jsdelivr and a Tesseract-project domain), cached by your browser afterward (each app's tab caches this separately the first time you use OCR in it). Image Toolkit's "Remove Background" tool works the same way: it runs Google's MediaPipe AI segmentation model in your browser (WebAssembly), downloading the runtime and model (around 3MB total) from jsdelivr and a Google Cloud Storage domain on first use, cached afterward. In every case the file itself is never uploaded anywhere — only that one-time, non-personalized model download happens, the same category of request as loading any of this site's other library code, just larger.

What's stored in your browser

A few small values live in your browser's local storage per tool — not sent to us, not readable by us, tied to this browser on this device only:

• All five paid tools: whether this browser is marked as subscribed, trialing, or lifetime-unlocked to that tool (each tool's subscription is separate) — there's no free-action count to track, since every tool requires an active trial, subscription, or lifetime purchase from the first use.
• Invoice Generator: your saved company profile (name, address, logo, currency) and the next invoice number and next quote number, so you don't retype them each time. Also your time-tracker log (project/client names, descriptions, dates, hours, and rates you've entered or timed), so it persists between visits until you delete an entry or bill it onto an invoice.
• Expense Log & Tax Pot Estimator: your ledger rows (dates, categories, descriptions, amounts, mileage, hours worked from home) and your tax band/rate/mileage settings, so your log and any custom rates persist between visits.
• Dividend Tax & Take-Home Pay Calculator: your last-entered company profit, salary, dividend amount/mode, and Employment Allowance choice, plus any custom tax settings, so your figures persist between visits. If you use the Payslip panel, also the employer/employee details you enter there (name, address, NI number, tax code, pay frequency) — not the pay date, which always resets to today.
• Image Toolkit: just your last-chosen output format, quality, and max dimension, so you don't have to reselect them every batch — never the images themselves, which only ever exist in memory while the tab is open.
• Your cookie-consent choice (Accept/Decline), so the banner doesn't ask twice.

Clearing your browser's site data for this domain resets all of it, including your subscribed/trialing status and your logged data. The Invoice Generator, Expense Log & Tax Pot Estimator, and Dividend Tax & Take-Home Pay Calculator each have a "Backup & restore" panel that downloads your real data (never your subscription status) as a .json file, which you can re-import on this or any other browser/device to restore it exactly — download one before clearing your data, or now and then as routine insurance. The Expense Tracker's CSV export is also free and unlimited, but it's a one-way record for your own use, not something you can re-import back into the tool.

Cookies and analytics

Two separate analytics tools run on this site, and they're treated differently on purpose:

• Cloudflare Web Analytics runs on every page load, for every visitor. It doesn't use cookies or any persistent identifier — Cloudflare can't and doesn't track you individually across visits or sites. It gives us aggregate numbers (roughly how many people visited which pages) and nothing more. Because it doesn't identify you, it isn't something you can opt out of here — there's nothing tied to you to opt out of.
• Google Analytics only loads if you click "Accept" on the cookie banner. It sets a cookie and can identify repeat visits to this site. If you click "Decline," or just don't answer, the Google Analytics script is never even loaded — not loaded-but-restricted, genuinely absent from the page. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.

Neither tool receives your PDF files, filenames, or anything about what you actually do with the tools — both only see which pages were loaded.

Payments

If you pay for any tool — the £5/month subscription or the £25 one-time lifetime purchase — checkout is handled entirely by Stripe. We never see or store your card details — they go directly to Stripe. Each tool has its own small, separate Cloudflare Worker that asks Stripe to confirm your payment for that specific tool is real (an active subscription, or an unrefunded one-time purchase), and that confirmation (not any card or personal data) is what unlocks unlimited use in your browser — paying for one tool doesn't unlock the others. Stripe may set its own cookies on its checkout page for fraud prevention; that happens on Stripe's domain, governed by their policy, not this one.

For PDF Toolkit specifically: because there's no account to unlock a purchase on a second browser or device, a successful subscription or lifetime purchase also generates a one-time license code (shown to you once, right after checkout — not emailed, not tied to your name or email). The Worker stores that code together with your Stripe customer reference (an ID Stripe generates, not anything you typed in) and which of the two you bought, in a small Cloudflare key-value store, so it can look the code up later. Redeeming a code on another browser doesn't just trust that stored record — it re-checks your payment with Stripe live each time (an active subscription, or that the original one-time payment hasn't been refunded), so a cancelled subscription's or refunded purchase's old code stops working on its own. This is the one place this site's Worker infrastructure stores anything at all, rather than just passing a yes/no answer through.

Who else sees anything

Three third parties are involved in running this site, each for one specific job:

• Cloudflare — hosts the small Workers that verify subscriptions (one per tool), runs the cookieless analytics above, and (PDF Toolkit only) stores the license-code-to-Stripe-customer mapping described under "Payments" above.
• Google — Analytics (only if you accept the cookie banner), hosts the pdf-lib/pdf.js/jsPDF libraries and the site's fonts (including PDF Toolkit's Fill & Sign handwriting-style fonts), and (Image Toolkit's "Remove Background" tool only) hosts the MediaPipe AI model downloaded on first use.
• Stripe — payment processing, only if you pay for a tool (subscription or lifetime purchase).

Your rights

Because there's no account and (with one narrow exception) no database, there's very little of "your data" held anywhere to act on — but for what does exist: you can see and delete the browser-local values above yourself, at any time, by clearing this site's data, and on the three tools listed above you can export a portable copy of it yourself at any time via that tool's "Backup & restore" panel (a plain .json file, readable in any text editor, containing only your actual data). The one exception is PDF Toolkit's license-code-to-Stripe-customer mapping (see "Payments" above) — there's no self-serve way to view or delete that record, since it isn't tied to anything you can look up yourself, but email us and we'll delete it on request. For anything held by Stripe (if you've subscribed), Google, or Cloudflare, their own privacy policies (linked above) cover access and deletion requests. Under UK GDPR you also have the right to complain to the ICO if you think any of this is being handled wrong.

Changes to this policy

If what this site collects changes, this page will be updated and the date at the top will change with it. Given the size of this project, that's a manual update rather than a versioned legal process — if something here looks stale, say so.